enable apikey auth in traefik

cookbooks/traefik/README.md

@@ -37,6 +37,23 @@ EntryPoint=/usr/local/bin/traefik
 Exec=--foo=bar --baz=qux ...
 ```
 
+## Community plugins
+
+Hosted (community) plugins are declared in the static configuration under
+`experimental.plugins` in `traefik.yaml`. They **cannot** be declared from the
+per-application dynamic configuration (`conf.d/`), so the declaration must live in
+`traefik.yaml` even when the middleware is only consumed by another cookbook.
+
+Traefik downloads and compiles plugins at startup into a `plugins-storage`
+directory **relative to its working directory**. Since the image `WORKDIR` is `/`
+(not writable by the unprivileged `traefik` user), the container sets
+`WorkingDir=/var/lib/traefik` so plugins land in the persistent, writable state
+volume.
+
+The example configuration ships the
+[`api-key-and-token-middleware`](https://plugins.traefik.io/plugins/66f6ac697dd5a6c3095befd3/api-key-and-token-middleware)
+plugin, used by the `vllm` cookbook to enforce Bearer/API-key authentication.
+
 ## Usage
 
 In a separate terminal, follow the logs.

cookbooks/traefik/config/examples/traefik.yaml

@@ -24,6 +24,19 @@ providers:
     directory: /etc/traefik/conf.d/
     watch: true
 
+# Hosted (community) plugins. Static plugin declarations MUST live here — they
+# cannot be declared from the per-application dynamic configuration (conf.d/).
+# Traefik downloads and compiles them at startup into ./plugins-storage (hence
+# the WorkingDir in traefik.container).
+#
+# api-key-and-token-middleware: Bearer/API-key authentication middleware, used
+# e.g. by the vLLM cookbook (see its conf.d/vllm.yaml).
+experimental:
+  plugins:
+    traefik-api-token-middleware:
+      moduleName: "github.com/Aetherinox/traefik-api-token-middleware"
+      version: "v0.1.4"
+
 # certificatesResolvers:
 #   le:
 #     acme:

cookbooks/traefik/traefik.container

@@ -23,6 +23,11 @@ AddCapability=CAP_NET_BIND_SERVICE
 Volume=/var/lib/quadlets/traefik:/var/lib/traefik:z
 Volume=/etc/quadlets/traefik:/etc/traefik:z
 
+# Run from the persistent, writable state directory so that hosted plugins
+# (experimental.plugins) can be downloaded and compiled into ./plugins-storage.
+# The image WORKDIR is "/", which is not writable by the unprivileged user.
+WorkingDir=/var/lib/traefik
+
 # Network
 Network=host